Now does that mean that a business (not for profit) can use it to
protect all their computers as long as they got less than 50 devices?

What we are looking at doing is getting Sophos Endpoint Protection - Advanced (we will need about 25 licenses) and having UTM setup to be used as a proxy server. Does anyone know if we would be on the wrong side of the law?